Rented Macs hand attackers root access through a Screen Sharing login
CISA upgraded the severity score for a macOS Screen Sharing vulnerability to a critical 9.8 out of 10 on Friday.
Dutch investigators have reported attackers gaining root control of internet-exposed Macs and quietly loading Monero mining software.
From 7.1 to 9.8 in a week
When Apple shipped its fix, CISA listed the bug, tracked as CVE-2026-65400, at 7.1 in the National Vulnerability Database. The agency changed it to 9.8, near the top of the CVSS scale.
The Netherlands’ National Cyber Security Centre took a similar approach. An update on August 12 revised an initial advisory to say that public proof-of-concept code was in circulation and that active abuse had been confirmed.
As of Friday, the flaw had not been included in a federal catalog of known attacked vulnerabilities maintained by the Cybersecurity and Infrastructure Security Agency. Apple’s own CVE record with the Dutch agency still had the older 7.1 rating.
The vulnerability is due to the way Screen Sharing handles authentication. The security company Huntress traced it to a flaw in the service’s use of Secure Remote Password, the protocol used to verify a user’s identity before granting access.
… Continue reading the full article at the original source below.
